Archive
September 2015
Vulnerabilities first published in this month (UTC), newest first.
493 results · Feed
-
Unscored —
The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path fr…
-
Unscored —
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 f…
-
Unscored —
The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not prope…
-
Unscored —
The Workbench Email module 7.x-3.x before 7.x-3.4 for Drupal allows remote authenticated users with certain permissions…
-
Unscored —CVE-2015-7235 Public exploit
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for W…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Impor…
-
Unscored —
The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user…
-
Unscored —
The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which all…
-
Unscored —
The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 d…
-
Unscored —CVE-2015-4040 Public exploit
Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Administrative Web Interface in Citrix NetScaler Application Delivery C…
-
Unscored —
Multiple unspecified vulnerabilities in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway be…
-
Unscored —CVE-2015-6962 Public exploit
SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands v…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to…
-
Unscored —CVE-2015-6972 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject…
-
Unscored —
Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does not properly restrict access to the (1) Design Mode and …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Nokia Networks (formerly Nokia Solutions and Networks and Nokia …
-
Unscored —
XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct serve…
-
Unscored —CVE-2015-5465 Public exploit
Silicon Integrated Systems WindowsXP Display Manager (aka VGA Driver Manager and VGA Display Manager) 6.14.10.3930 allo…
-
Unscored —
Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protectio…
-
Unscored —
Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote …
-
Unscored —
The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress…
-
Unscored —
Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attem…
-
Unscored —CVE-2015-6965 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for W…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack …
-
Unscored —
Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators t…
-
Unscored —
Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.…
-
Unscored —
HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unsp…
-
Low —
TYPO3 cross-site scripting (XSS)
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1)…
-
Unscored —
HP UCMDB 10.00 and 10.01 before 10.01CUP12, 10.10 and 10.11 before 10.11CUP6, and 10.2x before 10.21 allows local users…
-
Unscored —
Unspecified vulnerability in HP LoadRunner Controller before 12.50 allows local users to gain privileges via unknown ve…
-
Unscored —CVE-2015-6945 Public exploit
Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary w…
-
Unscored —
Heap-based buffer overflow in the Microsoft Word document conversion feature in Corel WordPerfect allows remote attacke…
-
Unscored —
Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted …
-
Unscored —CVE-2015-6946 EPSS 21%
Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers …
-
Unscored —
SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Sere…
-
Unscored —CVE-2015-6944 Public exploit
Cross-site request forgery (CSRF) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to hijack the …
-
Unscored —
Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remo…
-
Unscored —
Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.…
-
Unscored —
IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x befo…